Specify additional definition sets for network traffic inspection
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Network Inspection System Description
This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0.
Registry
HKLM
Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation Value name: Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Specify additional definition sets for network traffic inspection
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation]
"Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid
Data type: String
Value:
<enabled/>
<!-- Nis_Consumers_IPS_sku_differentiation_Signature_Set_GuidList: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation' -Name 'Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation' -Name 'Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify additional definition sets for network traffic inspection
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows Defender\NIS\Consumers\IPS\SKU Differentiation\Signature Set GUID'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.